aryabhata remainder theorem: relevance to public-key crypto ...

8 RAO AND YANG
3.2. Multiplicative inverse algorithm
The EEA can be improved to perform better if only one inverse is required. For
instance, if a −1 mod b is required for a > b, we may just as well begin with
a mod b = c and find c −1 mod b. In that case, the xi computation will be one less
step. Further, if the initial values are set appropriately, the inverse can be obtained
in n − 2 forward steps (each step: one multiplication and one addition), the same
number of steps as in the IAA (Section 1.2). We illustrate this by using the same
example as before with another table.
Example 5. Find 137 −1 mod 60 (a = 137 and b = 60)
We start with r0 = b = 60, r1 = a mod 60 = 17, and x1 = 1. The iterations
begin from i = 2 with the normal division process: qi ← quotient(ri−2/ri−1),
ri ← ri−2 mod ri−1, and x2 = q2.
The iteration proceeds: xi ← xi−1 · qi + xi−2 (for i > 2).
i ri qi xi
0 60 – –
1 17 – 1
2 9 3 3
3 8 1 4
4 1 1 7
5 0
From this we observe the following:
a · xi(−1) i−1 mod b = ri for i ≥ 1, 137 · 7(−1) 4−1 mod 60 = 1,
X = 137 −1 mod 60 = 60 − 7 = 53.
We can now state the following lemma.
Lemma 3. Let a, b, ri, qi, and xi be defined as above. Then a −1 mod b exists iff
xn = 1 (for some n > 1) and is given by
a −1 mod b = xn(−1) n−1 .
Proof. First, we need to prove that a · xi(−1) i−1 mod b = ri holds for i ≥ 1.
For i = 1, we have x1 = 1 and a · x1(−1) i−1 mod b = r1. Fori = 2, we have
the division equation r2 = r0 − q2 · r1 = r0 − x2 · r1. Taking mod b on both
sides, we get (−x2) · r1 mod b = r2, which is the same as (−x2)a mod b = r2.
For i = 3, we start with r3 = r1 − q3 · r2 = r1 · x1 − q3(r0 − x2 · r1) =
r1(x2 · q3 + x1) − q3 · r0 = r1 · x3 − q3 · r0. Taking mod b on both sides, we
have r1 · x3 mod b = r3 and a · x3 mod b = r3. Continuing this process, we obtain
a · xn(−1) n−1 mod b = rn = 1 and a −1 mod b = xn(−1) n−1 . ✷